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Bill, 


Here are a few things | could find related to Alfa Bank. Hope they help. | would definitely recommend reaching ou 
Brian/Joe/Paul et al though since more may have been done, the below may have been adjusted (and | know the U 
examined this as well but 1 don’t have those results electronically | don’t think}... 


The third attachment below are some talking points that were put together by Lisa and the 7" floor but the doc co 
afew summary bullets on Alfa. 


Thanks, 
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COMMUNICATIONS EXPLOITATION 
Chicago Division, Squad 1-4 
3 October 2016 


ne) FBI Chicago assesses Alfa-Bank and Trump Organization-related servers almost 
certainly? not commuficate intentionally or covertly, 


-FBI Chicago has high confidence” in this assessment, which is 
y reliable sensitive source with excellent access and corroborates FBI 
investigative activity conducted to date. 


(U) Scope Nol 
( Tyioriation in this document was derived from searches of DWS and Sentinel. 


\ 


* Appendix A: Expressions of Likelihood (or Probability) 


: Confidence in Sources Supporting Assessments and Judgments 
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al pata N 


FBI Chicago assesses Alfa-Bank and Trump 
Organization servers almost certainly did not communicate 


intentionally, based on an examination of Alfa-Bank servers 
BEE >. IT employees. Their examination 
ıypothesized Alfa-Bank DNS servers may have conducted 
DNS lookups of maill.trump-email.com in response to spam 
e-mail sent by US digital marketing companies Listrak or 


Cendyn One, which are associated with IP subnet 


66.216.133.0/24 and domain maill.trump-email.com. 
RS Alfa-Bank set up new 


respectively. Furthermore, 
monitoring and filtering sensors to detect and block future 
connection attempts. 


According to a sensitive source with 
excellent access, on an unknown date Stuart Bruseth. 
using email address sbruseth@letterone.com®, sent 
four individuals scans of documents which allegedly 
proved there was an active link between Alfa-Bank 
DNS servers and the domain maill.trump-email.com. 


(U) Investigation Background 


On or about 19 September 2016, 
an anonymous third party provided the US 
Department of Justice (DOJ) a whitepaper 
indicating a US-based server owned by the 
Trump Organization — domain 

mail! trump-email.com. associated with IP 
address 66.216.133.29 — had been covertly 
communicating with servers at Alfa-Bank 
in Moscow, Russia — IP addresses 
217.12.97.15 and 217.12.96.15 — between 
4 May 2016 and 4 September 2016. 


FBI, Create Case Request: 23 
September 2016 A 


(U) Source: 


reliability 
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Alfa-Bank’s conclusions cortoborate current FBI investigative activity, which 
has not identified any evidence fo support the whitepaper’s hypothesis that Alfa-Bank and 
Trump Organization servers intentionally, cove ly, communicated via DNS channels. 


* (U/FOUO) On 23 Septemb “the Director of US company Cendyn One informed 
the FBI that domain tump-éinail tom had very limited traffic over its lifespan. The 
domain had received approximately 14 e-mails over several years, all of which were 
blocked as spam or.malware.%* 


(U) Investigative/Intelligence Gaps 
FBI INTERNAL USE ONLY 


3 


SCO-FBIPROD_021323 


SCO_094869 


No. 1:21-cr-00582-CRC (D.D.C.) DX-563_0004 


FBLINTERNAL USE ONLY 


. men On what date and from whom did Stuart Bruseth acquire information about 
the potential connection between Alfa-Bank servers and maill.trump-email.com? 


e ma To what degree is LetterOne influenced by, directed by, or indebted to Alfa-Bank 
and the Government of Russia? In what ways does the relationship influence LetterOne’s 
investment activities in the United States? 


Consumer: SSA Daniel Wierzbicki 
SA Allison Sands 


Approval: SIA Terry Ober 


Contacts: IA Jessie Marie Eisenbart 


(U) This Communication Exploitation was prepared FBI Chicago and addresses the following threat citation, HQ- 
CD-201-II-17. 
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(U) Appendix A: Expressions of Likelihood (or Probability) 


(U) Phrases such as “the FBI judges” and “the FBI assesses,” and terms such as “likely” and 
“probably” convey analytical judgments and assessments. The chart approximates how 
expressions of likelihood and probability correlate with percentages of chance. 


UNCLASSIFIED 
Almost 7 Roughly 
z Very i Seg ie š : N Very Almost 
No Unlikely Unlikely Bren = ley = N N 
Chance j Chance : 7 


; Roughl 1 
Remote Highly Improbable SAY probable Highly Nearly 


Improbable (Improbably) A (Probably) Probable Certain 


(U) Unless otherwise stated, the FBI does not derive jud act analysis. 
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(U) Appendix B: Confidence in Sources Supporting Assessments and Judgments 


(U) Confidence levels reflect the quality and quantity of the source information supporting 
Judgment. Consequently, the FBI ascribes high, medium, or low levels of confidence to 
assessments, as follows: 


(U) High confidence generally indicates the FBI’s judgments are based on high quality 

information, from multiple sources. High confidence in a judgment does not imply the 4 
assessment is a fact or a certainty; such judgments might be wrong. While additional 
and information sources may change analytical judgments, such changes are mos likely 
refinements and not substantial in nature. 


(U) Medium confidence generally means the information is credibly sourced ausible but 
not of sufficient quality or corroborated sufficiently to warrant a higher levelofgenfidence. 
Additional reporting or information sources have the potential to increase the FBI's confidence 
levels or substantively change analytical judgments. “ 


(U) Low confidence generally means the information’s credibility ausibility is uncertain, 
the information is too fragmented or poorly corroborated to make solid analytic inferences, or the 
reliability of the sources is questionable. Absent additional reporting or information sources, 
analytical judgments should be considered preliminary in nature. 
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(U) Endnotes 
I 


tember 2016: 


' (UAFOUO) FBE FD-302, 27 September 2016: 23 September 2016; E “(U) Interview of 
Reagan Gerena”, UNCLASSIFIED: UNC LASSIFIED//F OR OFFICIAL USE ONLY: Source is an FBI interview of 


Reagan Gerena, Director, Interactive Design and Development, Cendyn í e. thie’ Company which hasted the domain 


27 September 2016: 27-28 


°? (U/FOUO) FBI: DWS: PIDs 261835281E. 261847133 EM 
September 2016; 
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FEDERAL BUREAU OF INVESTIGATION 


import Form 


Form Type: TacticalProduct Date: 10/03/2016 


Approved By: SIA Terry J Ober 


Drafted By: Jessie Marie Eisenbart 


Ma ALFA BANK; 
ROSSIA - CONTACTS / 


AGENTS 
SENSITIVE INVESTIGATIVE 
MATTER 
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Synopsis: , FBI Chicago assesses Alfa-Bank and Trump 
Organization re in vers almost certainly did not communicate 


intentionally or covertly 


= © 3 . -hicago has high 
confidence in this assessment, which is based on a highly reliable 
sensitive source with excellent access and corroborates FBI 
investigative activity conducted to date. 


Enclosure(s): Enclosed are the following items: 


i. 


++ 
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Talking Points re Crossfire Hurricane Cases 
March 8, 2017 


Introduction: 

» (U/FOUO) There has been an extraordinary amount of speculation re garding the FBI’s 
investigative efforts into potential ties between Russia and members of the Trump 
campaign. I’m here today to describe what the FBI is and is not doing with regard to 
these matters. 


. mad Hostile foreign governments deploy a wide range of foreign influence 
techniques. Foreign influence—also known as political influence—is defined as foreign- 
directed perception management or active measures operations intended to influence U.S. 
priority policies or policymakers in order to adversely affect national security. The FBI 
has always worked to disrupt foreign influence activities; this effort existed in the lead-up 
to the 2016 Presidential election and continues today. Of course the FBI’s work in this 
regard is not just focused on Russia. 


. ma Of primary concern to us are intelligence officers: those people trained to 
identify, recruit, and direct people to do things like gain access to classified information 
and otherwise clandestinely act as their agents. In the years preceding the election, the 
FBI is aware of contact between Russian intelligence officers and Carter Page: however, 
we did not see contact between Russian intelligence officers and members of the Trump 
campaign or administration, either in the months preceding the election or afterwards. 


° Mma A second category includes overt diplomats and government officials, people 
who, while not trained intelligence officers, still interact with U.S. government officials 


in many different contexts in order to pursue their nation’s policy objectives. This 
— includes id like Russian Ambassador ii — | 


. | A final group are personnel who function as co-optees, access agents, or agents 
of influence, who are not employed by a foreign government but nonetheless are used to 
advance governmental aims. For example, the FBI commonly encounters individuals 
who are Russian oligarchs or businessmen who may be motivated by a confluence of 
personal, business, and patriotic reasons. The FBI’s challenge and objective is to discern 
whether a particular action is motivated by the individual’s own interest, the foreign 
nation they are associated with, or some combination of both, As part of this current 
effort, the FBI is looking at these types of Russian actors and their efforts targeting 
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individuals affiliated with the Trump campaign and administration, which I will describe 
next. 


Predication: 
+» 


On July 27, 2016, a friendly foreign govermment contacted the FBI to advise that 
in May 2016, George Papadopoulos, an individual identified at that time by then- 
Presidential Candidate Trump as an official foreign policy advisor for the Trump 
campaign, told him/her that Papadopoulos was aware that, as described by the foreign 
government, “the Trump team had received some kind of suggestion from Russia that it 
[Russia] could assist [the campaign] with the anonymous release of information during 
the campaign that would be damaging to Mrs. Clinton (and President Obama).” This 
statement predicated the CROSSFIRE HURRICANE umbrella investigation. 
Papadopoulos did not identify the campaign individual who purportedly 
received the suggestion from Russia, nor did he identify how or whether the 
Trump team reacted to the offer. In an effort to identify the potential recipient of 
the “suggestion,” the FBI identified four individuals who it deemed more likely to 
have engaged in such contact with the Russians. 

The below summaries provide a snapshot as of this moment of the current status 
of the still ongoing investigations. 


© 


Crossfire Hurricane Cases: 


George Papadopoulos (EEN - In mid-March 2016, George 
Papadopoulos was identified by then-Presidential Candidate Trump as an official foreign 


policy advisor for the Trump campaign. 

o The FBI interviewed Papadopoulos on multiple occasions in late January 
and early February, 2017. Papadopoulos admitted to receiving information in 
early 2016 from a UK-based think tank director with professed connections to the 
Government of Russia. According to Papadopoulos, the think tank director stated 

Russia possessed “dirt on [Clinton]” in the form of “thousands” of emails. 

Papadopoulos also admitted to contact with the same friendly foreign government 

that provided the FBI with the predicating information. However, Papadopoulos 

has not confirmed the information reported by the friendly foreign government 
source regarding Papadopoulos’s knowledge of contact between the Trump team 
and the Russians. 

o Since his last interview in mid-February, Papadopoulos has refused to 
meet with the FBI. 


e Carter Pace EN - In mid-March 2016, Carter Page was 
identified by then-Presidential Candidate Trump as an official foreign policy advisor for 
the Trump campaign. Page also has a long history of ties to the Russian Federation, 
including business relationships, financial investments, travel, and direct contact with 
Russian Foreign Intelligence Service (SVR) intelligence officers, and had been an FBI CI 
subject prior to the Crossfire Hurricane investigation. 

© In reports prepared by CROWN, a former FBI CHS, Page was reported tò 
have had "secret meetings" in early July 2016 with a named individual in Russia's 
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Presidential Administration during which they discussed Russia's release of 
damaging information on Hillary Clinton in exchange for alterations to the GOP 
platform regarding U.S. policy towards Ukraine. (This statement has not yet been 
corroborated). The reports prepared by CROWN further indicated that Paul 
Manafort was reported to have initially “managed” the relationship between 
Russian government officials and the Trump campaign, using Carter Page as an 
intermediary. In the wake of increased media scrutiny over his dealings with 
Russia, Page's role in the campaign was publicly disavowed in late September 
2016, and after that time there appears to be minimal contact between Page and 
members of the Trump campaign and administration. 

o coverage of Page was authorized on October 21, 2016, and 
renewed iw mid-January 2017. No drafts of the Si applications were “denied” 
by the Court. 


. 1 Paul J. Manafort, | - Paul Manafort was the campaign 
chairman and chief strategist for then-Presidential candidate Donald Trump between May 


and August 2016. Manafort has long standing ties to current and former members of the 
pro-Russian political faction in Ukraine, including ties with former Ukrainian president 
Viktor Yanukovych, and he has conducted business deals with Russian and Ukrainian 
oligarchs. 

o Ma In reports prepared by CROWN, a former FBI CHS, Manafort was 
reported fo have initially “managed” the relationship between Russian 
government officials and the Trump campaign, using Carter Page as an 
intermediary. (This statement has not yet been corroborated). In the wake of 
increased media scrutiny over his dealings with Russia and Ukraine in mid- 
August 2016, Manafort was initially demoted within the Tramp campaign and 
subsequently resigned. 


e Michael Flynn - Retwed Lieutenant General and former DIA 
Director Michael T. Flynn was a foreign policy advisor to then-Presidential Candidate 
Trump since late 2015. Flynn has a history of ties to the Russian Federation, including 
professional relationships, travel, and direct contact with staff at the Russian Embassy in 
Washington. D.C. 

o Ma Flynn engaged in a series of telephone calls with Russian 
Ambassador Kislyak in late December 2016, including discussions about a UN 
vote on Israeli settlements and discussions regarding the U.S. expulsion of 
Russian diplomats and facility closures. 

o These calls were collected via traditional | coverage of the 
Russian Embassy in Washington, D.C. 

© This collection did not involve Section 702. 

o The FBI routinely monitors foreign establishments to understand their 
clandestine intelligence activities here in the U.S. Importantly, while this 
activity targets the foreign power, in pursuit of its counterintelligence 
mission, the FBI monitors this collection in an effort to discover U.S. 
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persons who may be targeted by the foreign power, or engaged in 
clandestine intelligence gathering on behalf of a foreign power. 


o (U//FOUO) Flynn was interviewed by the FBI on January 24, 2017. 
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Potential Ouestions and Answers re Crossfire Hurricane Cases 
March 8, 2017 


HEOUO) If asked about POTUS Tweets: 
e To date, the FBI has not conducted electronic surveillance targeting Candidate 


Trump or President Trump, his “server,” or any member of his administration, now, or 
during the campaign. Media reports indicating otherwise are inaccurate. 

. Additionally, no draft applications regarding these areas were presented to 
En Court and withdrawn. That reporting is also inaccurate. 


oO 


Alfa Bank: In fall 2016, the FBI received an allegation that Alfa Bank, a 
Russian bank with close ties to the Kremlin, was covertly communicating with the 
Trump campaign. In assessing this allegation, the FBI determined that a U.S.- 
based server, which housed an email domain previously used to send advertising 
emails on behalf of President Trump’s hotel business, was trying to communicate 
with the bank’s server. 

A U.S.-based company administered the email domain and the 
related hotel business marketing campaign, and a separate U.S.-based company 
ran a U.S.-based server that housed it. The administering company indicated the 
email domain had been discontinued by Trump’s hotel business. Ultimately, the 
FBI (and two private computer security companies) found no evidence of emails 
being sent between the bank and the candidate’s discontinued business domain. 
And contrary to press reports, no surveillance was used to 
investigate the Alfa Bank allegation regarding the server, and no draft 
applications were presented to the FISC. 


If asked about CROWN /Steele: 

CROWN, a former FBI CHS, is a former friendly foreign intelligence service 
employee who has reported for about three years, and some of whose reporting has been 
corroborated. CROWN has been previously compensated by the FBI, however, the 
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information regarding Russian activities directed at the Trump campaign was collected 


by CROWN on behalf of private clients. 
. mm CROWN maintains a network of sub-sources, who, in many cases, utilize their 


own sub-sources. CROWN ’s reporting in this matter is derived primarily from a 
Russian-based source, who uses a network of sub-sources. The FBI has no control over 
the Russian-based sub-source or any of the sub-sources used by the Russian-based sub- 
source. 

° Ma The FBI did not pay CROWN for the information on Russia’s activities relating 
to Trump and the Trump campaign. The FBI only paid for CROWN 's travel 
arrangements to meet with us. 

© Independent of his pre-existing source relationship to the FBI, CROWN was 
retained by an individual who been hired, first by a Republican primary 
challenger to Trump (identity unknown to the FBI), and later by an entity related 
to the Democratic Party (identity also unknown to the FBD). 

o Following his collection and production of information to his client(s), CROWN 
approached and voluntarily provided the FBI with the information he had 
collected, based on his stated patriotic concern about the nature of the 
information. 

o Oo o] After receiving the information, the FBI met with CROWN and told him 
tbat while the allegations in the reports were significant, the FBI needed eyidence 
to support the allegations made in the reporting. The FBI stated that depending 
on the nature of such evidence, the FBI might be willing to pay for such material. 
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Redlines re Crossfire Hurricane Cases 
March 7, 2017 


e Discussion of the identity of the foreign nation providing the predicating information. 


Discussion related to the FBI’s input into the AG’s recusal decision, on deliberative 
process grounds. 


e 


Discussion of whether any US Attomey’s office has been assigned to any case, as well as 
detail regarding future investigative strategy or prosecutive discussion. 
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INTELLIGENCE MEMO 


FBI Couuteriutelligence Division, Special Project 


26 ii 2016 


Server in Russia Registered to Alfa Bank Communicating with 
Trump Organization Server 


FBI Counterintelligence Division has reviewed material provided by a source to the FBI 
on 19 September 2016. The material concluded a Trump Organization server is covertly 
communicating with a server registered to Alfa Bank, one of Russia’s largest banks. According 
to the source-provided material, these communications have taken place directly between servers 
as well as through multiple layers of obfuscation using (a) TOR and (b) a compromised server 
owned by Spectrum Health in Michigan. 


Although FBI Chicago and FBI Miami are continuing to investigate, including obtaining 
og data, the preliminary assessment is that it is unlikely, though possible, that the server was 
used in the way described in the source-provided material. 


ME FBI Summary of Source-Provided Report on Identified Trump Organization Server 


(U) The Trump Organization server, maill.trump-email.com hosted by Pennsylvania-based 
Listrak, highly restricts the sources from which it accepts emails, and this server only had look- 
ups from 19 IP addresses between 4 May and 4 September 2016. During this time period, the 
majority of look-ups came from an Alfa Bank server. 


+ (U) The report provided to the FBI characterizes this activity as highly suspect 
considering the size of the organization and how much email activity it would typically 
process over a 90-day period. 


e (U) Listrak handles mass marketing emails for which many recipient servers conduct tens 
or hundreds of thousands of look-ups to verify a server (e.g., for spam or malware), and 
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such look-ups would be equally distributed among organizations associated with the IP 
addresses. 


« (U) The majority of look-ups from Alfa Bank suggested to the report’s authors that this 
mail server was set up to masquerade as a regular, non-mail server, and that it may be 
facilitating a form of secure communications. 


The source-provided report identified the Trump Organization server-in-question as a 
mail server, maill.trump-email.com, using IP address 66.216.133.29, The parent domain was 
noted as trump-email.com, which is registered to the Tramp Organization. FBI Miami confirmed 
that trump-email.com is a mail server used by Trump Hotels. Central Dynamics, in partnership 
with Trump Organization, established the maill.trump-email.com in 2009. The domain was 
never used by Central Dynamics and does not currently point to an active mail server. A review 
of the domain’s spam filter showed receipt of 15 inbound emails, one of which passed through 
the server’s filter, and an additional email marked as spam and blocked. The receipt dates of 
these emails are unknown at this time. 


° (U) The mail server maill.trump-email.com is hosted by Pennsylvania-based Listrak, 
which is a customer relationship management company providing large-scale distribution 
of marketing emails. 


e (U) The mail server mail] ttump-email. com is configured to only accept emails from pre- 
determined and pre-approved IP addresses, which indicates that this is an active mail 
server, though it highly restricts the sources from which it will accept emails. 


(U) From 4 May to 4 September 2016, 19 IP addresses attempted to send email to mail] trump- 
email.com. Further, the IP addresses which attempted to contact this server the most belonged to 
Alfa Bank, Spectrum Health, and Domo, Inc., a VPN provider in Salt Lake City, Utah. 


¢ (U) The majority of look-ups coming from Alfa Bank IP addresses were for the A 
(regular) record as opposed to MX (mail record), which implies that this mail server was 
set up to masquerade as a regular (non-mail) server. Further, A record look-ups are 
appropriate for another form of communication (e.g., VPN, secure connection, text 
connection, efc.). 
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(U) The activity breakdown for this time period (975 total look-ups for this email server) is as 
follows: 


Look-Ups to mail1 trump-email.com 
4 May - 4 September 2016 


Alfa Bank 


| Spectrum Health _ 
Domo, inc. 98 


Other N 32 | a Domo, Inc. 
g Obit ISP. 


9, 
10% 0%,3% m Alfa Bank 


i Other (Malware) 


(U) The Spectrum Health IP address 167.73.110.8 is being used by Alfa Bank as a TOR exit 
node to communicate with the mail] .trump-email.com server. This implies that this IP address is 
either the victim of a computer intrusion or internal entities intentionally configured it as a TOR 
node. [ANALYST COMMENT: The report does not include substantiation regarding Alfa 
Bank 's use of the Spectrum Health IP address as a TOR exit node, but that information may be 
gleaned from the TOR Project] 


N FBI Reporting on Alfa Bank and Its Connection to Russian Government Officials 
and Russian Intelligence Services (RIS) 


(U) Alfa [Alpha] Group Consortium (aka Alfa Group) is one of Russia’s largest privately-owned 
investment groups. Open source reporting on Alfa Bank, owned by Alfa Group, identifies 
Mikhail Fridman, German Khan, Petr Aven, and Alexei [Aleksey] Kuzmichev as its key 
executives. 


From 2008 to 2015, FBI reporting described ties between Alfa Bank and/or key 
executives and the Russian intelligence services (RIS). 


! (U) Obit ISP is located in St. Petersburg and is owned by Alfa Bank. 
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e In 2003, FBI reporting stated that the Solntsevo Organized Crime Syndicate, 
ounded by members of the KGB, allegedly used Alfa Bank to move unknown fimds. The 
group’s leaders have close affiliations with Mikhail Fridman. In April 2014, a source 
reported that German Khan represented the interests of Solntsevo within the Alfa Group 
Consortium (Alfa Group). In comparison to Mikhail Fridman and Petr Aven, the source 
noted that Khan had the most criminal background. Additionally, the source reported that 
Fridman and Aven did business for the KGB. 123 


From February 2008 to February 2012, Rogozin served as the Vice 
Counsel at the Russian Consulate in New York. In 2013, he was on a three-month 
temporary duty assignment (TDY) to the Russian Embassy in Washington, DC. 
The U.S. Department of State declared Rogozin persona non grata before the 
completion of his TDY.” 


* From 19 January 2016 to 21 September 2016, 138 applicants listed their employer 
as Alfa Bank, or a variant thereof, on their NIV application. Three of these 
individuals listed Alfa Bank’s address as their own. Of possible interest, seven 
applicants listed their occupation as ‘Computer Science.’ The applicants were of 
the following nationalities: Russia (128); Belarus (4); Uzbekistan (2); Kyrgyzstan 
(2); Ukraine (1); Israel (1). Additionally, the largest number of applicants, 28 in 
total, arrived the week of 24 April 2016. 


D | On 28 July 2015, an FBI contact reported that Mikhail Fridman received 
financial support from the Government of Russia (GOR). Fridman had been trying to ally 
himself with Western businesses (NFI).’ 


e eed Petr Aven, the president of Alfa Bank from 1994 to June 2011, maintains a close 
relationship with Vladimir Putin. According to an FBI report, the two men were business 
partners in the early 1990s and, as of late 1998, Putin was on Alfa Bank’s payroll. Aven 
currently sits as the chairman to Alfa Bank’s Luxembourg-based investment holding 
company.®9!0 
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